pointerset
Overview
Details
Usage: | pointerset threshold pointer=threshold_pointer_field ptrFieldFilter="perc*|*outlier_threshold" default=0
| makeresults
| eval Field1=1
| eval Field2=2
| eval Field3=3
| eval Field4=4
| eval pointer_field="Field4"
| pointerset newField pointer="pointer_field"
| Field1 | Field2 | Field3 | Field4 | pointer_field | newField |
| 1 | 2 | 3 | 4 | Field4 | 4 |
Similar to pointers in C, this allows you to dereference a field like a pointer to fetch a value from another field.
OVERVIEW
pointerset <target_field> pointer=<ptrField> ptrFieldFilter="srcField-1|srcField-2|srcPattern*" default=<default value>
target_field:
- The field to create and set
- Required
pointer:
- The field that contains the name of the field with the value we want to set target_field to.
- Required
- If the field doesn't exist on the event the default is used
ptrFieldFilter:
- This option can accept basic patterns for mattching with a *, no other wildcard characters are available.
- Multiple field/field patterns can be specified using pipes: "Field*|OtherPattern*|*_MySuffix"
- Optional, default value is * (all fields)
- Warning: Performance over large datasets almost requires you to specify the ptrFieldFilter option. This list should only contain field names that 'pointer' can point to.
default:
- Optional, default value is ""
Basic example
| makeresults
| eval Field1=1
| eval Field2=2
| eval Field3=3
| eval Field4=4
| eval pointer_field="Field4"
| pointerset newField pointer="pointer_field"
| Field1 | Field2 | Field3 | Field4 | pointer_field | newField |
|---|---|---|---|---|---|
| 1 | 2 | 3 | 4 | Field4 | 4 |
Larger datasets:
For larger datasets be sure to specify the ptrFieldFilter otherwise performance will be impacted:
| makeresults
| eval Field1=1
| eval Field2=2
| eval Field3=3
| eval Field4=4
| eval pointer_field="Field4"
| pointerset newField pointer="pointer_field" ptrFieldFilter="Field*"
Release Notes
Version 1.4.1
Version 1.3
Added appIcon